firewall: protect iptables invocations with locks in interface ops, it might run...